A Multimodal Monitoring Data Anomaly Detection Method and System Based on Vertical Model

Abstract

This application discloses a method and system for anomaly detection in multimodal monitoring data based on a vertical model, relating to the field of monitoring data anomaly detection technology. The method includes the following steps: performing log and hardware correlation analysis on the normal vector set and the anomaly vector set respectively to obtain normal correlation mappings and anomaly correlation mappings; constructing a vertical model using the normal and anomaly correlation mappings; constructing a re-inspection feature set using the modal feature information corresponding to the common vectors of the normal and anomaly correlation mappings; performing a first anomaly judgment on the real-time multimodal monitoring data based on a preset initial detection threshold and the re-inspection feature set; performing a second anomaly judgment based on the first anomaly judgment result and the vertical model; and outputting the anomaly detection result. The beneficial effects of this application are: avoiding missed detection of complex anomalies through re-inspection features, while reducing the computational load of the second anomaly judgment in the vertical model, thus improving the accuracy of anomaly detection while ensuring computational efficiency as much as possible.

Description

Technical Field

[0001] This application relates to the field of monitoring data anomaly detection technology, and in particular to a method and system for multimodal monitoring data anomaly detection based on a vertical model. Background Technology

[0002] To ensure the stability of the power grid, it is necessary to monitor the power grid system, using log text and hardware data to monitor for anomalies. However, current technologies typically employ independent analysis strategies for monitoring signals of different modalities, such as log text and hardware status, for example, rule-based log parsing or threshold-based hardware indicator monitoring. This separate processing approach makes it difficult to capture potential correlations between logs and hardware data, resulting in poor detection models for complex anomalies and low anomaly detection accuracy.

[0003] In other related technologies, neural network models are used to predict real-time monitoring data and determine whether the monitoring data of the future state exceeds a threshold in order to achieve proactive maintenance. This relies on the accuracy of the prediction results, and using a fixed threshold to determine whether the monitoring data of the future state exceeds the threshold still has the problem of low accuracy in anomaly detection.

[0004] The patent, "Alarm Method, Device, Storage Medium, and Electronic Equipment for Anomaly Monitoring Data," publication number CN118797523A, published on October 18, 2024, discloses a method including: collecting monitoring data to be detected within a preset time window; acquiring a trained monitoring data anomaly discrimination model, which is obtained by training a large model; determining the alarm threshold corresponding to the monitoring data based on the trained monitoring data anomaly discrimination model; determining whether the state of the monitoring data is abnormal based on the alarm threshold; and triggering an alarm for the monitoring data when the state of the monitoring data is abnormal. This solution improves the accuracy of anomaly detection by dynamically changing the alarm threshold based on the monitoring data through large model training. However, the model relies on training and calculation with a large amount of data. When there is a large amount of monitoring data, it is necessary to calculate a large amount of monitoring data in real time to obtain multiple monitoring data thresholds, resulting in low efficiency in anomaly identification. Summary of the Invention

[0005] This application addresses the problem in existing technologies where accuracy and efficiency in monitoring data anomaly detection cannot be simultaneously achieved. It provides a method and system for multimodal monitoring data anomaly detection based on a vertical model. First, a preset initial detection threshold is used to filter out monitoring data exceeding a fixed threshold, reducing subsequent computation. Simultaneously, features requiring re-inspection are obtained through common vectors from normal and abnormal states. Multimodal data matching only the re-inspection features are used as input to the vertical model. By using re-inspection features, the missed detection of complex anomalies is avoided, improving the accuracy of monitoring data anomaly detection. Furthermore, in large-scale monitoring data anomaly detection, only a small portion of multimodal data needs vector transformation and association mapping, compensating for the efficiency reduction caused by secondary judgment. This approach maximizes both the accuracy of monitoring data anomaly detection and computational efficiency.

[0006] To achieve the above technical objectives, this application provides a technical solution: a multimodal monitoring data anomaly detection method based on a vertical model, comprising the following steps: dividing historical multimodal monitoring data into normal datasets and abnormal datasets based on historical anomaly events; performing vector transformation on log text data and hardware numerical data in the normal datasets and abnormal datasets respectively to obtain normal vector sets and abnormal vector sets; wherein the vector sets include at least log vectors and hardware vectors; performing log and hardware correlation analysis on the normal vector sets and abnormal vector sets respectively to obtain normal correlation mappings and abnormal correlation mappings; constructing a vertical model using the normal correlation mappings and abnormal correlation mappings; constructing a re-inspection feature set using the modal feature information corresponding to the common vectors of the normal correlation mappings and abnormal correlation mappings; performing an anomaly judgment on the real-time multimodal monitoring data according to a preset initial detection threshold and the re-inspection feature set; performing a second anomaly judgment based on the vertical model associated with the first anomaly judgment result; and outputting the anomaly detection result.

[0007] Furthermore, the step of performing vector transformations on the log text data and hardware numerical data in the normal dataset and the abnormal dataset respectively to obtain a normal vector set and an abnormal vector set includes: using a word embedding method to perform vector transformation on the log text data in the normal dataset and the abnormal dataset to obtain normal log vectors and abnormal log vectors; using a normalization method to perform vector transformation on the hardware numerical data in the normal dataset and the abnormal dataset to obtain normal hardware vectors and abnormal hardware vectors; constructing a normal vector set using the normal log vectors and the normal hardware vectors, and constructing an abnormal vector set using the abnormal log vectors and the abnormal hardware vectors.

[0008] Furthermore, the step of performing log and hardware correlation analysis on the normal vector set and the abnormal vector set respectively to obtain normal correlation mapping and abnormal correlation mapping includes: constructing a time-series mapping for log vectors and hardware vectors in the normal vector set and the abnormal vector set according to the same time sequence; performing cluster analysis on the time-series mapping to obtain clusters; obtaining the mapping weights of log vectors and hardware vectors based on the size of the clusters; and constructing normal correlation mapping and abnormal correlation mapping based on the mapping weights and the time-series mapping.

[0009] Furthermore, the step of performing log and hardware correlation analysis on the normal vector set and the abnormal vector set respectively to obtain normal correlation mapping and abnormal correlation mapping also includes: mapping the log normal vectors and hardware normal vectors according to the time sequence to obtain normal correlation mapping; and mapping the log abnormal vectors and hardware abnormal vectors according to the abnormal event window to obtain abnormal correlation mapping.

[0010] Furthermore, the step of mapping log anomaly vectors and hardware anomaly vectors according to anomaly event windows to obtain anomaly association mappings also includes: dividing log anomaly vectors and hardware anomaly vectors according to anomaly event windows, first filtering out the temporal associations between log anomaly vectors and hardware anomaly vectors according to normal association mappings, and then performing mapping based on the filtering results to obtain anomaly association mappings.

[0011] Furthermore, the step of performing an anomaly judgment on the real-time multimodal monitoring data based on the preset initial detection threshold and the re-inspection feature set, and performing a second anomaly judgment based on the vertical model associated with the first anomaly judgment result, and outputting the anomaly detection result includes: obtaining the preset initial detection threshold using hardware anomaly indicators and log anomaly indicators; outputting a first anomaly detection result when the real-time multimodal monitoring data does not meet the preset initial detection threshold; matching the re-inspection feature set with the real-time multimodal monitoring data after excluding the first anomaly detection result, and synchronously outputting a second anomaly detection result corresponding to the matching result based on the output matching result as input to the vertical model during the matching process; wherein, the first anomaly judgment result includes the first anomaly detection result and the matching result.

[0012] Furthermore, during the matching process, the step of synchronously using the output matching result as input to the vertical model and outputting a second anomaly detection result corresponding to the matching result includes: during the matching process, in response to any matching result output, the vertical model outputs a normal mapping result and an anomaly mapping result based on the matching result; during the mapping result output process, the second anomaly detection result is synchronously obtained based on the degree of matching between the real-time multimodal monitoring data and the normal mapping result and the anomaly mapping result.

[0013] Furthermore, during the matching process, synchronously using the output matching results as input to the vertical model and outputting a second anomaly detection result corresponding to the matching results includes: during the matching process, in response to any matching result output, the vertical model outputs normal mapping results and abnormal mapping results with different mapping weights based on the matching results; during the mapping result output process, synchronously calculating the overall matching degree of normal mapping results and abnormal mapping results based on the matching of real-time multimodal monitoring data with normal mapping results and abnormal mapping results, and calculating the overall matching degree of normal mapping results and abnormal mapping results based on the individual matching degree and mapping weight of all mapping results; and outputting the second anomaly detection result based on the overall matching degree and the individual matching degree.

[0014] Furthermore, the step of outputting the second anomaly detection result based on the overall matching degree and the individual matching degree includes: when the overall matching degree of the normal mapping result is higher than the overall matching degree of the abnormal mapping result, but there exists an abnormal mapping result whose individual matching degree is higher than the individual matching degree of each normal mapping result, the log anomaly and / or hardware anomaly corresponding to the abnormal mapping result is still used as the second anomaly detection result.

[0015] Another technical solution provided in this application is a multimodal monitoring data anomaly detection system based on a vertical model, used to implement the above method, comprising: a data acquisition unit for acquiring multimodal monitoring data; a vector conversion unit for performing vector conversion on log text data and hardware numerical data in the multimodal monitoring data to obtain a normal vector set and an anomaly vector set; a mapping construction unit for performing correlation analysis of logs and hardware based on the normal vector set and the anomaly vector set to construct a normal correlation mapping and an anomaly correlation mapping; a model construction unit for constructing a vertical model based on the normal correlation mapping and the anomaly correlation mapping; a primary anomaly judgment unit for constructing a re-inspection feature set based on the modal feature information corresponding to the common vectors of the normal correlation mapping and the anomaly correlation mapping, and performing a primary anomaly judgment on the real-time multimodal monitoring data based on a preset initial detection threshold and the re-inspection feature set to obtain a primary anomaly judgment result; and a secondary anomaly judgment unit for associating the vertical model based on the primary anomaly judgment result, performing a secondary anomaly judgment, and outputting anomaly detection results.

[0016] The beneficial effects of this application are as follows: 1. By converting log text data and hardware numerical data into vectors through vector transformation, the alignment of log data and hardware data can be improved. Then, correlation analysis of log and hardware data can be performed on normal and abnormal vector sets respectively to obtain the correlation patterns of log and hardware modal data under abnormal and normal events. A vertical model is constructed based on these correlation patterns. The modal features corresponding to vectors present in both normal and abnormal events are used as the re-examination feature set. An anomaly judgment is first performed on the real-time multimodal monitoring data based on a preset initial detection threshold and the re-examination feature set. Then, based on the result of this anomaly judgment... The system determines whether to call the vertical model if there are re-inspection features. This eliminates the need to call the vertical model when there are no modal features that exceed the preset initial inspection threshold and no modal features that need to be re-inspected, thus reducing the waste of useless computing resources. At the same time, it uses modal feature information that exists in both normal and abnormal events as the re-inspection target. This can avoid false alarms and false negatives caused by a single threshold, and can quickly locate the monitoring data that needs to be re-inspected when there is a possible anomaly. It also reduces the amount of computation for vector transformation and correlation mapping in the process of re-inspection, thereby improving the accuracy of anomaly detection in monitoring data while ensuring computational efficiency as much as possible.

[0017] 2. When constructing the association mapping between log anomaly vectors and hardware anomaly vectors within the anomaly event window, first, the log anomaly vectors and hardware anomaly vectors containing the complete fault process are divided through the anomaly event window. Then, the time-series associations within the anomaly window that conform to normal operating rules are first filtered out through normal association mapping. For example, query logs accompanied by brief fluctuations in disk I / O are filtered out. After filtering, what is retained are the operating rules unique to the anomaly event window, such as the anomaly association between the dense occurrence of error codes and the cliff-like increase in memory usage. This avoids the normal operating rules from misleading the association rules during the fault period and improves the accuracy of anomaly detection root cause analysis. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the multimodal monitoring data anomaly detection method based on a vertical model, as described in this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description of this application is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely one preferred embodiment of this application and are only used to explain this application. They do not limit the scope of protection of this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] like Figure 1As shown in the first embodiment of this application, the multimodal monitoring data anomaly detection method based on a vertical model includes the following steps:

[0021] Based on historical abnormal events, historical multimodal monitoring data is divided into normal datasets and abnormal datasets;

[0022] The log text data and hardware numerical data in the normal dataset and the abnormal dataset are respectively vectorized to obtain normal vector sets and abnormal vector sets; wherein the vector sets include at least log vectors and hardware vectors;

[0023] Log and hardware correlation analysis were performed on the normal vector set and the abnormal vector set respectively to obtain normal correlation mapping and abnormal correlation mapping;

[0024] A vertical model is constructed using normal association mapping and abnormal association mapping;

[0025] A re-examination feature set is constructed using the modal feature information corresponding to the common vectors of normal association mapping and abnormal association mapping;

[0026] Based on the preset initial detection threshold and the set of re-detection features, an anomaly judgment is performed on the real-time multimodal monitoring data. Based on the result of the first anomaly judgment, a second anomaly judgment is performed by associating with the vertical model, and the anomaly detection result is output.

[0027] In this embodiment, log text data and hardware numerical data are uniformly converted into vectors through vector transformation to facilitate alignment between log and hardware data. Then, correlation analysis is performed on the normal vector set and the abnormal vector set to obtain the correlation patterns between log and hardware modal data under abnormal and normal events. A vertical model is constructed based on these correlation patterns, and the modal features corresponding to vectors present in both normal and abnormal events are used as the re-examination feature set. First, an anomaly judgment is performed on the real-time multimodal monitoring data based on a preset initial detection threshold and the re-examination feature set. Then, based on the anomaly judgment result... The system determines whether to call the vertical model if there are no re-inspection features. This eliminates the need to call the vertical model when there are no modal features that exceed the preset initial inspection threshold and no modal features that need to be re-inspected, thus reducing the waste of useless computing resources. At the same time, it uses modal feature information that exists in both normal and abnormal events as the re-inspection target. This can avoid false alarms and false negatives caused by a single threshold, and can quickly locate the monitoring data that needs to be re-inspected when there is a possible anomaly. It also reduces the amount of computation for vector transformation and correlation mapping in the process of re-inspection, thereby improving the accuracy of anomaly detection of monitoring data while ensuring computational efficiency as much as possible.

[0028] Historical multimodal monitoring data includes at least historical log text data and historical hardware numerical data. The historical multimodal monitoring data is divided based on the occurrence time of historical anomalies and the maintenance time of the anomaly target. The anomaly target maintenance time is the time when the maintenance target corresponding to the historical anomaly event was completed. For example, in a historical anomaly event, the CPU was replaced; the time when the CPU maintenance was completed is obtained and used as the anomaly target maintenance time. An anomaly dataset is constructed using the historical log text data and historical hardware numerical data corresponding to the period from the occurrence time of the historical anomaly to the maintenance time of the anomaly target. This ensures that all data from the occurrence to the end of the anomaly is considered anomaly data, improving the accuracy of subsequent anomaly identification. It is understood that before dividing the historical multimodal monitoring data into normal and anomaly datasets, erroneous and missing data has already been filtered and supplemented. Therefore, the normal dataset is constructed using the data from the historical multimodal monitoring data excluding anomaly data.

[0029] Vector transformations are performed on the log text data and hardware numerical data in the normal and abnormal datasets respectively to obtain the normal vector set and the abnormal vector set, including:

[0030] We use word embedding to perform vector transformation on log text data in normal and abnormal datasets to obtain normal log vectors and abnormal log vectors.

[0031] The normalization method is used to perform vector transformation on the hardware numerical data in the normal dataset and the abnormal dataset to obtain the normal hardware vector and the abnormal hardware vector.

[0032] Construct a normal vector set using log normal vectors and hardware normal vectors, and construct an abnormal vector set using log abnormal vectors and hardware abnormal vectors.

[0033] In some embodiments, log text data and hardware numerical data are vectorized using word embedding and normalization methods, respectively. During the transformation process, log text data and hardware numerical data are distinguished based on different vector dimensions to avoid confusion between log vectors and hardware vectors in the subsequent mapping process. In other embodiments, log text data in normal datasets, log text data in abnormal datasets, hardware numerical data in normal datasets, and hardware numerical data in abnormal datasets can also be distinguished using four different vector dimensions.

[0034] In some other embodiments, vector transformation is performed on the log text data and hardware numerical data in the normal dataset and the abnormal dataset respectively to obtain the normal vector set and the abnormal vector set, including:

[0035] We use word embedding methods to perform vector transformation on log text data in a normal dataset to obtain normal log vectors.

[0036] The normalization method is used to perform vector transformation on the hardware numerical data in the normal dataset to obtain the normal hardware vector;

[0037] Based on common vocabulary, the log anomaly vector corresponding to the log text data and the hardware anomaly vector corresponding to the hardware numerical data in the anomaly dataset are fixed according to the log normal vector and the hardware normal vector.

[0038] The fixed anomaly dataset is transformed into vectors using word embedding and normalization methods to obtain log anomaly vectors and hardware anomaly vectors.

[0039] Construct a normal vector set using log normal vectors and hardware normal vectors, and construct an abnormal vector set using log abnormal vectors and hardware abnormal vectors.

[0040] At this point, the log text data in both the normal and abnormal datasets are segmented into words, and a vocabulary is constructed based on the segmentation results. Words present in both the normal and abnormal datasets are marked in this vocabulary. Then, a word embedding model is trained using the normal dataset and the vocabulary to obtain a normal semantic model, and the marked vectors in the normal semantic model are output. Similarly, a word embedding model is trained using the abnormal dataset, the marked vectors, and the vocabulary to obtain an abnormal semantic model. This method locks the shared word vectors, ensuring consistency in semantic dimensions between the normal and abnormal semantic models, avoiding semantic space drift caused by scenario-specific training. Furthermore, under the constraint of the marked vectors, the vectors of non-shared words tend to form clearer boundaries with the normal semantic space, enhancing their interpretability. During the training of the abnormal semantic model, the marked vectors corresponding to shared words are frozen, reducing the amount of gradient computation during training. By training the normal and abnormal semantic models separately using two models, the dilution effect of the normal dataset on the abnormal dataset is avoided, preventing a large amount of normal data from masking the semantic features of the abnormal data. Simultaneously, the method of freezing shared words during training compensates for the reduced computational efficiency caused by training two models.

[0041] Hardware numerical data includes CPU utilization, memory usage, disk I / O values, etc. Different hardware numerical data are converted into vectors of a uniform scale through normalization methods, so that the association mapping between hardware and software can be directly constructed based on the vectors.

[0042] Log and hardware correlation analysis is performed on the normal vector set and the abnormal vector set respectively to obtain normal correlation mapping and abnormal correlation mapping, including:

[0043] Construct a timing mapping for log vectors and hardware vectors in the normal vector set and the abnormal vector set based on the same timing sequence;

[0044] Cluster analysis is performed on the time-series mapping to obtain clusters. The mapping weights of log vectors and hardware vectors are obtained based on the size of the clusters. Normal association mappings and abnormal association mappings are constructed based on the mapping weights and the time-series mapping.

[0045] By aligning time sequences to obtain time-series mappings, text modalities and numerical modalities are aligned to reveal cross-modal correlations between logs and hardware. Then, cluster analysis is performed on the concatenated cross-modal correlation vectors, with the size of the clusters representing the frequency of occurrence of different time-series mappings. The mapping weight coefficients of different time-series mappings are obtained, and normal correlation mappings and abnormal correlation mappings are constructed by combining time-series mappings and mapping weights to distinguish the differences in correlation patterns between normal and abnormal scenarios, thereby improving the efficiency of anomaly detection.

[0046] In other embodiments, performing log and hardware correlation analysis on the normal vector set and the abnormal vector set respectively to obtain normal correlation mapping and abnormal correlation mapping further includes:

[0047] Map the log normal vector and the hardware normal vector according to the timing to obtain the normal association mapping;

[0048] Map log exception vectors and hardware exception vectors according to the exception event window to obtain exception association mapping.

[0049] In this embodiment, log events under normal conditions are correlated with hardware status through timing to reflect the synchronous change patterns during stable operation. Conversely, log events under abnormal conditions are correlated with hardware status through an abnormal event window to reflect the correlation patterns during fault periods. Different mapping benchmarks are used to obtain the timing synchronization change patterns of hardware and logs through a normal vector set, and to obtain the correlation patterns of hardware and logs under fault conditions through an abnormal vector set.

[0050] Specifically, mapping log exception vectors to hardware exception vectors based on exception event windows to obtain exception association mappings also includes:

[0051] Log anomaly vectors and hardware anomaly vectors are divided according to the anomaly event window. First, the time-series associations of log anomaly vectors and hardware anomaly vectors are filtered out based on the normal association mapping. The mapping is then performed based on the filtering results to obtain the anomaly association mapping.

[0052] When constructing the association mapping between log anomaly vectors and hardware anomaly vectors within the anomaly event window, the log anomaly vectors and hardware anomaly vectors containing the complete fault process are first divided through the anomaly event window. Then, the time-series associations within the anomaly window that conform to normal operating rules are first filtered out through normal association mapping. For example, query logs accompanied by brief fluctuations in disk I / O are filtered out. After filtering, what is retained are the operating rules unique to the anomaly event window, such as the anomaly association between the dense occurrence of error codes and the cliff-like increase in memory usage. This avoids the normal operating rules from misleading the association rules during the fault period and improves the accuracy of anomaly detection root cause analysis.

[0053] For example, using 45 seconds as the time window for time-series mapping, the log normal vector and the hardware normal vector are aligned according to 45 seconds. The correlation between the log normal vector and the hardware normal vector is obtained using the Pearson correlation coefficient or machine learning algorithm, and a normal correlation mapping is constructed.

[0054] The anomaly event window is the time interval from the occurrence of an anomaly event to the maintenance time of the anomaly target. In logs, the window starts at the first occurrence of an anomaly log and ends when the log returns to normal. In hardware, the window starts at the occurrence of hardware numerical anomalies and ends when the hardware numerical values ​​return to normal. The anomaly event window is compensated by the time of the maintenance target's anomaly and the time of its recovery. Since the time interval from the occurrence of the anomaly event to the maintenance time of the anomaly target was already used as the dividing criterion when dividing the normal and anomaly datasets, we only need to divide the anomaly vectors based on continuous time windows. Log anomaly vectors and hardware anomaly vectors within the same continuous time window are classified as vectors to be associated within the same anomaly event window. Then, for the vectors to be associated within the same anomaly event window, we first filter out existing normal operation patterns using normal association mapping, and then use the PrefixSpan algorithm to obtain the sequence association between the log anomaly vectors and hardware anomaly vectors in the filtering results, thus obtaining the anomaly association mapping. It is understandable that in other cases, the Granger Test can also be used to perform causal analysis between log anomaly vectors and hardware anomaly vectors, thereby demonstrating the causal relationship between logs and hardware under abnormal states. In some cases, decision tree analysis can also be used to obtain normal and abnormal association mappings, thereby revealing the sequential influence relationships between various features.

[0055] In this embodiment, normal and abnormal correlation mappings are incorporated into the knowledge base of the vertical model. Combined with the question-and-answer process during the initial training of the vertical model (e.g., defining the boundaries of normal fluctuations), normal fluctuations and abnormal correlations within the current domain are recorded. A domain fluctuation feature library is then formed based on these normal and abnormal correlations. This feature library is used to correct the normal and abnormal correlation mappings, such as adjusting abnormal event windows, time-series windows, and abnormal mapping relationships, further improving their adaptability to the current domain. In initial applications, historical multimodal monitoring data from similar domains can be used as initial training data for the normal and abnormal correlation mappings, avoiding the problem of insufficient historical data leading to inability to construct mapping relationships correctly in the initial application of the current domain. The question-and-answer mode is used to correct the normal and abnormal correlation mappings, making them more consistent with the current domain and improving the accuracy of their initial application. Furthermore, in this embodiment, the normal and abnormal correlation mappings are constructed first, and then corrected through question-and-answer methods. This eliminates the need for extensive user interaction; only key mapping deviations need to be corrected, reducing user interaction requirements and achieving lightweight correction.

[0056] Simultaneously, the modal feature information corresponding to the common vectors in the normal and abnormal association mappings is used as the re-examination features. The vectors simultaneously contain the modal features and their corresponding information. For example, regardless of whether the system is normal or abnormal, the continuously used hardware will record its values. This is represented by common vectors, using modal features with common values ​​or text in both normal and abnormal states, along with their information, as the re-examination features. It's understandable that the common vectors here are different from the common vocabulary mentioned above. Common vocabulary is only reflected in the vector of a single word, and the abnormal vector is transformed by fixing the vector of that word. Here, the common vectors are based on the previously fixed common vocabulary, ensuring that the same modal information has the same vector in both normal and abnormal states. Therefore, the modal features corresponding to the common vectors represent hardware information or log information that may exist in both normal and abnormal states.

[0057] It should be noted that when there are differences in the modal feature information corresponding to the common vectors, the difference information is used as feedback information of the previous common vocabulary to correct the common vocabulary vectors.

[0058] It should be noted that when performing vector transformations between normal and abnormal datasets using different vector dimensions, the common vector is obtained after transformation based on the vector dimension.

[0059] In some cases, an anomaly detection is performed on the real-time multimodal monitoring data based on a preset initial detection threshold and a set of re-detection features. Then, based on the result of the initial anomaly detection and the association with a vertical model, a second anomaly detection is performed. The output anomaly detection results include:

[0060] Obtain the preset initial detection threshold based on hardware anomaly indicators and log anomaly indicators;

[0061] When the real-time multimodal monitoring data does not meet the preset initial detection threshold, the first anomaly detection result is output.

[0062] The real-time multimodal monitoring data after excluding the first anomaly detection result is used to match the re-examination feature set. Based on the matching result, the vertical model is selected and called to perform a second anomaly judgment and output the second anomaly detection result.

[0063] The result of an anomaly assessment includes the first anomaly detection result and the matching result.

[0064] In this embodiment, a preset initial detection threshold is set based on hardware anomaly indicators and log anomaly indicators. Hardware anomaly indicators can be those set by the manufacturer at the time of hardware shipment or self-defined anomaly indicators specific to the field. Log anomaly indicators can be fixed anomaly information in the log messages, such as "crash," "error," or "mistake." By using a fixed preset initial detection threshold, logs and hardware that are certain to be abnormal are identified first, ensuring the efficiency of identifying serious faults while reducing the computational load of subsequent anomaly detection. Simultaneously, a secondary screening of the real-time multimodal monitoring data is performed using a set of re-inspection features. When real-time multimodal monitoring data contains data matching the re-inspection features, a re-inspection is considered necessary. Even if the real-time multimodal monitoring data does not exceed the preset initial detection threshold, the simultaneous presence of multiple hardware data and log text messages that do not exceed the preset initial detection threshold may still indicate anomalies. These anomalies are screened out using re-inspection features and re-inspected. The vertical model is only invoked when re-inspection features are present, ensuring the accuracy of anomaly detection while minimizing the computational load of re-inspection. In other embodiments, the preset initial detection threshold can also be set based on the hardware value and log text data corresponding to the maximum frequency of occurrence of abnormal events.

[0065] Specifically, based on the matching results, the vertical model is selected for invocation, a secondary anomaly detection is performed, and the second anomaly detection results are output, including:

[0066] If the matching result shows that there is a re-examination feature match, the re-examination feature is used as the input of the vertical model, and the normal mapping result and the abnormal mapping result are output.

[0067] The second anomaly detection result is obtained based on the degree of matching between real-time multimodal monitoring data and normal and abnormal mapping results;

[0068] If the matching result is that there is no matching feature for re-examination, the vertical model will not be called, the secondary anomaly judgment will not be performed, and only the first anomaly detection result will be output.

[0069] The vertical model obtains the mapping results of the current re-inspection feature under normal conditions and the mapping results under abnormal conditions. The mapping results are matched with real-time multimodal monitoring data. If the matching degree between the real-time multimodal monitoring data and the normal mapping result is higher than the matching degree with the abnormal mapping result, the second anomaly detection result is no anomaly. If the matching degree between the real-time multimodal monitoring data and the normal mapping result is lower than or equal to the matching degree with the abnormal mapping result, the second anomaly result is the abnormal mapping result and the log anomaly and / or hardware anomaly corresponding to the re-inspection feature.

[0070] It should be noted that in this embodiment, the vertical model outputs normal mapping results and abnormal mapping results based on the cluster and mapping weight corresponding to the current re-examination feature, so as to reflect the normal mapping result and abnormal mapping result with the highest probability.

[0071] In other embodiments, based on pre-built mapping weights, a vertical model is selected and invoked according to the matching results to perform a secondary anomaly judgment, and the output of the second anomaly detection result includes:

[0072] If the matching result is that there is a re-examination feature match, the re-examination feature is used as the input of the vertical model, and the normal mapping result and abnormal mapping result with different mapping weights are output.

[0073] Perform real-time multimodal monitoring data matching with normal and abnormal mapping results, and calculate the overall matching degree of normal and abnormal mapping results based on the individual matching degree and mapping weight of all mapping results;

[0074] The second anomaly detection result is output based on the overall matching degree and the individual matching degree.

[0075] If the matching result is that there is no matching feature for re-examination, the vertical model will not be called, the secondary anomaly judgment will not be performed, and only the first anomaly detection result will be output.

[0076] In this embodiment, the normal and abnormal mapping results corresponding to all clusters are used as the output of the vertical model. The matching degree of each normal and abnormal mapping result is calculated one by one. Then, the overall matching degree of the normal and abnormal mapping results is calculated based on the matching degree and mapping weight. The computation is large, but it can avoid deviations that may occur during the mapping result calculation. For example, if there are mapping results with low mapping weights but high matching degrees, directly obtaining the overall mapping result based on the mapping weights will cause a large deviation in the mapping results, resulting in subsequent matching degree errors. Instead, all mapping results are output and the individual matching degree of all mapping results is calculated. The overall matching degree and individual matching degree are used to output the second anomaly detection result.

[0077] Specifically, the second anomaly detection result is output in terms of overall matching degree and individual matching degree, including:

[0078] When the overall matching degree of normal mapping results is higher than that of abnormal mapping results, but there is a situation where the matching degree of a single abnormal mapping result is higher than that of a single normal mapping result, the log abnormality and / or hardware abnormality corresponding to that abnormal mapping result is still used as the second abnormality detection result.

[0079] The detection error caused by low mapping weights is compensated by a single matching degree. Specifically, when the overall matching degree of an abnormal mapping result is higher than or equal to the overall matching degree of a normal mapping result, but a single matching degree of a normal mapping result is higher than the single matching degree of each abnormal mapping result, the log anomaly and / or hardware anomaly corresponding to the abnormal mapping result with the highest single matching degree is used as the second anomaly detection result to exclude the influence of special cases on anomaly detection. In other embodiments, when the overall matching degree of an abnormal mapping result is higher than or equal to the overall matching degree of a normal mapping result, but a single matching degree of a normal mapping result is higher than the single matching degree of each abnormal mapping result, the second anomaly detection result is output based on the matching degree of the preceding time series. For example, if the matching degree of the preceding time series multimodal monitoring data with the normal mapping relationship is higher than the matching degree with the abnormal mapping relationship, the second anomaly detection result is no anomaly. If the matching degree of the preceding time series multimodal monitoring data with the normal mapping relationship is lower than or equal to the matching degree with the abnormal mapping relationship, the log anomaly and / or hardware anomaly corresponding to the abnormal mapping result is used as the second anomaly detection result.

[0080] It is understood that the anomaly detection results include the first anomaly detection result and / or the second anomaly detection result.

[0081] In the above scenario, monitoring data with serious faults are first screened out based on a preset initial detection threshold. The user is then notified of the first anomaly detection result so that they can address the serious faults promptly. A re-inspection feature set is then used to match features requiring re-inspection, reducing the amount of data entering the vertical model. This effectively reduces the computational load of the vertical model in the detection of large volumes of monitoring data, compensating for the efficiency reduction caused by secondary judgments. This improves the accuracy of anomaly detection while maximizing its efficiency.

[0082] In other cases, an anomaly detection is performed on the real-time multimodal monitoring data based on a preset initial detection threshold and a set of re-detection features. Then, based on the result of the initial anomaly detection and the association with a vertical model, a second anomaly detection is performed, and the anomaly detection results are output, including:

[0083] Obtain the preset initial detection threshold based on hardware anomaly indicators and log anomaly indicators;

[0084] When the real-time multimodal monitoring data does not meet the preset initial detection threshold, the first anomaly detection result is output.

[0085] The real-time multimodal monitoring data after excluding the first anomaly detection result is used to match the re-examination feature set. During the matching process, the output matching result is used as the input of the vertical model to output the second anomaly detection result corresponding to the matching result.

[0086] The result of an anomaly assessment includes the first anomaly detection result and the matching result.

[0087] At this point, monitoring data with serious faults are first screened out according to the preset initial inspection threshold. Then, the data to be inspected in real-time multimodal monitoring data is matched through the re-inspection feature set. When any data to be inspected is output, the vertical model is called synchronously. In the subsequent matching process of data to be inspected, the secondary anomaly judgment of the vertical model is executed synchronously to further reduce the calculation delay caused by the secondary judgment. On the basis of reducing the calculation amount of the secondary anomaly judgment of the vertical model, the calculation efficiency is improved by synchronously executing the re-inspection feature matching and the secondary anomaly judgment.

[0088] Specifically, during the matching process, the already output matching results are used as input to the vertical model, and the output of the second anomaly detection results corresponding to the matching results includes:

[0089] During the matching process, in response to any matching result output, the vertical model outputs normal mapping results and abnormal mapping results based on the matching results;

[0090] During the mapping result output process, a second anomaly detection result is obtained synchronously based on the degree of matching between real-time multimodal monitoring data and normal and abnormal mapping results.

[0091] It should be noted that in this case, the matching result is the real-time multimodal monitoring data corresponding to the re-inspection feature. When there is no data requiring re-inspection in the real-time multimodal monitoring data, no matching result is output. Therefore, when a matching result is output, the vertical model immediately outputs the normal mapping result and the abnormal mapping result based on the matching result, without waiting for all matching results to be output. When the normal mapping result and the abnormal mapping result corresponding to a matching result are output, the second anomaly detection result corresponding to that matching result is immediately calculated, without waiting for all normal mapping results and abnormal mapping results to be output. This achieves the synchronous execution of secondary anomaly detection and re-inspection feature matching, reduces waiting time, and improves computational efficiency.

[0092] In another embodiment of this scenario, during the matching process, the output of a second anomaly detection result corresponding to the matching result is synchronously used as input to the vertical model based on the already output matching result, including:

[0093] During the matching process, in response to any matching result output, the vertical model outputs normal mapping results and abnormal mapping results with different mapping weights according to the matching result;

[0094] During the mapping result output process, the matching of real-time multimodal monitoring data with normal and abnormal mapping results is synchronized, and the overall matching degree of normal and abnormal mapping results is calculated based on the individual matching degree and mapping weight of all mapping results.

[0095] The second anomaly detection result is output based on the overall matching degree and the individual matching degree.

[0096] It is understandable that at this time, the normal mapping results and abnormal mapping results with different mapping weights actually correspond to a matching result. Therefore, when a matching result is output, without waiting for the output of other matching results, the vertical model is immediately used to calculate the second anomaly detection result. By executing the subsequent matching and the second anomaly judgment synchronously, the delay problem caused by the second judgment is minimized and the calculation efficiency is improved.

[0097] As a second embodiment of this application, a multimodal monitoring data anomaly detection system based on a vertical model includes:

[0098] The data acquisition unit is used to collect multimodal monitoring data;

[0099] The vector conversion unit is used to perform vector conversion on log text data and hardware numerical data in multimodal monitoring data to obtain normal vector sets and abnormal vector sets;

[0100] The mapping construction unit is used to perform correlation analysis between logs and hardware based on the normal vector set and the abnormal vector set, and to construct normal correlation mapping and abnormal correlation mapping;

[0101] The model building unit is used to build vertical models based on normal association mappings and abnormal association mappings.

[0102] An anomaly detection unit is used to construct a re-inspection feature set based on the modal feature information corresponding to the common vector of the normal correlation mapping and the anomaly correlation mapping, and to perform an anomaly detection on the real-time multimodal monitoring data according to the preset initial detection threshold and the re-inspection feature set, and obtain an anomaly detection result.

[0103] The secondary anomaly detection unit is used to associate the vertical model with the primary anomaly detection result, perform secondary anomaly detection, and output the anomaly detection result.

[0104] In this embodiment, the data acquisition unit is connected to the vector conversion unit, the vector conversion unit is connected to the mapping construction unit, the mapping construction unit is connected to the model construction unit, the primary anomaly judgment unit is connected to the data acquisition unit and the secondary anomaly judgment unit, and the secondary anomaly judgment unit is determined based on the result of the primary anomaly judgment. The secondary anomaly judgment unit is connected to the vector conversion unit and the model construction unit. When the secondary anomaly judgment unit is activated, the secondary anomaly judgment unit calls the vector conversion unit to perform real-time multimodal monitoring data vector conversion, and calls the vertical model in the model construction unit to perform secondary anomaly judgment.

[0105] The anomaly detection result includes the first anomaly detection result obtained based on the preset initial detection threshold and the matching result obtained based on the re-detection feature set.

[0106] In other embodiments, when the primary anomaly detection unit outputs any matching result, the vector conversion unit and the secondary anomaly detection unit are immediately activated, so that the primary anomaly detection unit, the vector conversion unit, and the secondary anomaly detection unit run synchronously, reducing the delay of secondary anomaly detection. While improving accuracy through secondary detection, the computational efficiency is improved by synchronous execution and reducing the computational load of the vertical model.

[0107] The specific embodiments described above are preferred embodiments of the multimodal monitoring data anomaly detection method and system based on the vertical model of this application, and are not intended to limit the specific implementation scope of this application. The scope of this application includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape and structure of this application are within the protection scope of this application.

Claims

1. A method for anomaly detection in multi-modal monitoring data based on vertical model, characterized in that: Comprising the following steps: According to the historical abnormal events, the historical multi-modal monitoring data is divided into a normal data set and an abnormal data set; The log text data and hardware numerical data in the normal data set and the abnormal data set are respectively subjected to vector conversion to obtain a normal vector set and an abnormal vector set; wherein the vector set at least includes log vectors and hardware vectors; The normal vector set and the abnormal vector set are respectively subjected to correlation analysis of logs and hardware to obtain a normal correlation mapping and an abnormal correlation mapping; A vertical model is constructed based on the normal correlation mapping and the abnormal correlation mapping; A recheck feature set is constructed based on the modal feature information corresponding to the common vectors of the normal correlation mapping and the abnormal correlation mapping; According to a preset primary detection threshold and the recheck feature set, a real-time multi-modal monitoring data is subjected to a one-time abnormality judgment, and a vertical model is associated according to a one-time abnormality judgment result to perform a two-time abnormality judgment, and an abnormality detection result is output.

2. The multi-modal monitoring data abnormality detection method based on a vertical model according to claim 1, wherein: the log text data and the hardware numerical data in the normal data set and the abnormal data set are respectively subjected to vector conversion to obtain a normal vector set and an abnormal vector set, comprising: the log text data in the normal data set and the abnormal data set are subjected to vector conversion by using a word embedding method to obtain log normal vectors and log abnormal vectors; the hardware numerical data in the normal data set and the abnormal data set are subjected to vector conversion by using a normalization method to obtain hardware normal vectors and hardware abnormal vectors; the normal vector set is constructed based on the log normal vectors and the hardware normal vectors, and the abnormal vector set is constructed based on the log abnormal vectors and the hardware abnormal vectors.

3. The multi-modal monitoring data abnormality detection method based on a vertical model according to claim 1, wherein: the normal vector set and the abnormal vector set are respectively subjected to correlation analysis of logs and hardware to obtain a normal correlation mapping and an abnormal correlation mapping, comprising: the log vectors and the hardware vectors in the normal vector set and the abnormal vector set are constructed into a time sequence mapping according to the same time sequence; the time sequence mapping is subjected to cluster analysis to obtain a cluster, and the mapping weight of the log vectors and the hardware vectors is obtained based on the size of the cluster, and the normal correlation mapping and the abnormal correlation mapping are constructed based on the mapping weight and the time sequence mapping.

4. The multi-modal monitoring data abnormality detection method based on a vertical model according to claim 1, wherein: the normal vector set and the abnormal vector set are respectively subjected to correlation analysis of logs and hardware to obtain a normal correlation mapping and an abnormal correlation mapping, further comprising: the log normal vectors and the hardware normal vectors are mapped according to the time sequence to obtain the normal correlation mapping; the log abnormal vectors and the hardware abnormal vectors are mapped according to an abnormal event window to obtain the abnormal correlation mapping.

5. The multi-modal monitoring data abnormality detection method based on a vertical model according to claim 4, wherein: the log abnormal vectors and the hardware abnormal vectors are mapped according to the abnormal event window to obtain the abnormal correlation mapping, further comprising: The log exception vector and the hardware exception vector are divided according to the exception event window, the time sequence correlation of the log exception vector and the hardware exception vector is screened out according to normal correlation mapping, and the screening result is used to perform mapping to obtain an exception correlation mapping. 6.The vertical model based multi-modal monitoring data anomaly detection method of claim 1, wherein: the one-time anomaly judgment is performed on the real-time multi-modal monitoring data according to the preset preliminary detection threshold and the recheck feature set, the vertical model is associated according to a one-time anomaly judgment result, a two-time anomaly judgment is performed, and an anomaly detection result is output. the preset preliminary detection threshold is obtained according to the hardware exception indicator and the log exception indicator; when the real-time multi-modal monitoring data does not meet the preset preliminary detection threshold, a first anomaly detection result is output; the real-time multi-modal monitoring data after the first anomaly detection result is excluded is matched with the recheck feature set, in the matching process, the matching result that has been output is used as an input of the vertical model, and a second anomaly detection result corresponding to the matching result is output; the one-time anomaly judgment result includes the first anomaly detection result and the matching result. 7.The vertical model based multi-modal monitoring data anomaly detection method of claim 6, wherein: in the matching process, the matching result that has been output is used as the input of the vertical model, and the second anomaly detection result corresponding to the matching result is output, including: in the matching process, in response to any matching result output, the vertical model outputs a normal mapping result and an abnormal mapping result according to the matching result; in the mapping result output process, the second anomaly detection result is obtained according to the matching degree of the real-time multi-modal monitoring data and the normal mapping result and the abnormal mapping result. 8.The vertical model based multi-modal monitoring data anomaly detection method of claim 6, wherein: in the matching process, the matching result that has been output is used as the input of the vertical model, and the second anomaly detection result corresponding to the matching result is output, including: in the matching process, in response to any matching result output, the vertical model outputs a normal mapping result and an abnormal mapping result of different mapping weights according to the matching result; in the mapping result output process, the second anomaly detection result is obtained according to the matching of the real-time multi-modal monitoring data and the normal mapping result and the abnormal mapping result, the overall matching degree of the normal mapping result and the abnormal mapping result is calculated according to the single matching degree of all mapping results and the mapping weight; the second anomaly detection result is output according to the overall matching degree and the single matching degree. 9.The vertical model based multi-modal monitoring data anomaly detection method of claim 8, wherein: the second anomaly detection result is output according to the overall matching degree and the single matching degree, including: when the overall matching degree of the normal mapping result is higher than the overall matching degree of the abnormal mapping result, but the single matching degree of a certain abnormal mapping result is higher than the single matching degree of each normal mapping result, the log exception or / and the hardware exception corresponding to the abnormal mapping result is still taken as the second anomaly detection result. including:

10. A multi-modal monitoring data anomaly detection system based on vertical models for implementing the method of any one of claims 1 to 9, characterized in that: a data acquisition unit, configured to acquire multi-modal monitoring data. ​ The vector conversion unit is configured to perform vector conversion on log text data and hardware numerical data in the multi-modal monitoring data, and obtain a normal vector set and an abnormal vector set; The mapping construction unit is configured to perform correlation analysis of logs and hardware according to the normal vector set and the abnormal vector set, and construct a normal correlation mapping and an abnormal correlation mapping; The model construction unit is configured to construct a vertical model according to the normal correlation mapping and the abnormal correlation mapping; The primary abnormality judgment unit is configured to construct a recheck feature set by using modality feature information corresponding to common vectors of the normal correlation mapping and the abnormal correlation mapping, and perform primary abnormality judgment on real-time multi-modal monitoring data according to a preset primary inspection threshold and the recheck feature set, and obtain a primary abnormality judgment result; The secondary abnormality judgment unit is configured to associate the vertical model according to the primary abnormality judgment result, perform secondary abnormality judgment, and output an abnormality detection result.

Images